Linux Kernel: skb_tx_error on Source skb in skb_zerocopy()
CVE-2026-90049 Published on September 16, 2026
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
skb_zerocopy() copies frags from @from into @to. On an
skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive
operation on the source skb the copy helper does not own. That completes
@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the
SKBFL_SHARED_FRAG page-ownership marker.
Both callers already report the failure on their own drop path.
nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in
the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by
dropping it here.
On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on
this error: do_execute_actions() ignores output_userspace()'s return
value and, unless the upcall was the last action, keeps forwarding the
same skb through the flow's remaining actions. The uarg is completed
while that skb is still in flight, telling the producer its buffers are
free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack
still handles. That flag is what makes esp_input() call skb_cow_data()
instead of decrypting in place, so a later local ESP delivery can
decrypt over frags the skb does not own privately.
Leave error reporting to the callers.
Products Associated with CVE-2026-90049
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below 849bdb83123760a865bcb2970127f4c0b9423ba3 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below fb10e0e9b220a2eed08931a60dbaad9a2370c908 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below 767ec2a65cc022d303b0c9c12811e7db22057341 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below 8069643ae64dfdf634b6c78c7f622e5323031436 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below 04dd250a78e268af3e7124beb1dc10ec1dd88d60 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below a13b1e80e5015cd732440b475c0ef443dc4a2157 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below bab5a851e44a3601d31f2aa8043f385bb50ac5d9 is affected.
- Version 36d5fe6a000790f56039afe26834265db0a3ad4c and below 8ece906150128d5ec2462aabcc978c568433eca4 is affected.
- Version c5f0c0e7525443add533495e93ba8de6feab2396 is affected.
- Version 1674b4bf3eea3cac51b70778e89f8025f7cfe695 is affected.
- Version 3.10.51 and below 3.11 is affected.
- Version 3.12.40 and below 3.13 is affected.
- Version 3.14 is affected.
- Before 3.14 is unaffected.
- Version 5.10.270, <= 5.10.* is unaffected.
- Version 5.15.221, <= 5.15.* is unaffected.
- Version 6.1.188, <= 6.1.* is unaffected.
- Version 6.6.157, <= 6.6.* is unaffected.
- Version 6.12.110, <= 6.12.* is unaffected.
- Version 6.18.51, <= 6.18.* is unaffected.
- Version 7.2.5, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.